Metasploit Framework CVE-2026-109681

Exploitation requires an operator to actively drive a Metasploit FTP client module into passive mode (PASV or EPSV) against an attacker-controlled or compromised FTP server; the vulnerable path trusts the IP octets in the server's 227/229 response and connects there instead of the control-connection host. The attacker-side server needs no authentication, but exploitation is limited by the required operator-initiated interaction (UI:R) - the victim must choose to connect to the rogue server - and impact is bounded to initiating an outbound TCP connection to an arbitrary host:port (blind/semi-blind SSRF), with no data read, modification, or availability loss beyond that connection.

This is a moderate-severity, low-priority SSRF (CWE-918) in the Metasploit Framework's FTP client libraries, confirmed by the provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N (base 4.7, Medium). The signals are internally consistent and point to limited real-world risk: although AV:N/PR:N indicate a network-reachable, server-side-unauthenticated trigger, UI:R is the key limiter - a human operator must actively initiate an FTP session to a rogue or compromised server before the flaw fires, so this cannot be driven as a mass, automated campaign. S:C (scope change) correctly reflects that the coerced connection leaves the FTP client's own authority and reaches an attacker-chosen host, but impact is capped at C:L with I:N/A:N, i.e. a largely blind/semi-blind outbound TCP connection rather than data theft or code execution. No EPSS score, CISA KEV entry, or POC flag was supplied in the intelligence, so there is no evidence of active exploitation or weaponization; the only artifact is the Rapid7 patch PR itself. The affected component is a penetration-testing tool rather than production infrastructure, further lowering practical priority. Bottom line: a legitimate but low-urgency fix - patch on a normal cycle; this is a high-plausibility-but-low-impact issue, not an emergency.

An attacker stands up (or compromises) a malicious FTP server and lures a Metasploit operator into pointing an FTP-using module at it. When the client issues PASV/EPSV, the rogue server returns a 227/229 response advertising an arbitrary IP:port (e.g. an internal 169.254/10.x host), and the operator's machine dutifully opens a TCP connection to that target, yielding blind SSRF/port-probing from the operator's network position. No public exploit identified at time of analysis, though the Rapid7 pull request documents the exact vulnerable parsing path.